CVE-2026-14947: CWE-24 Path Traversal: '../filedir' in Frauscher Sensortechnik FDS 102

CVE-2026-14947 is a path traversal vulnerability (CWE-24) in Frauscher Sensortechnik FDS 102. A remote attacker with high privileges can upload a ZIP archive containing directory traversal sequences such as '../' to bypass the intended extraction directory. Due to improper validation of archive entry paths, the attacker can write files to arbitrary locations on the server filesystem. This can lead to arbitrary code execution and potentially full system compromise. The vulnerability affects versions >=2.8.0 and <=2.13.3. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond high privilege, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows a high-privileged remote attacker to write files outside the intended directory, potentially leading to arbitrary code execution and full system compromise. This compromises confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, restrict high-privileged remote access to the affected system and monitor for suspicious archive uploads.